VPN-ka Android wuxuu ku shaqeeyaa IPv6, laakiin browser-ku wali wuxuu doortaa IPv4

VPN-ku wuu shaqaynayaa, isdhexgalka webka gaarka ahi wuxuu ku jawaabaa IPv6 isagoo ka imanaya laptop, taleefanka Android-na wali wuxuu isla bogga ku furaa IPv4 ama wuu diidaa inuu gabi ahaanba soo rarto. Diiwaanka AAAA wuu jiraa. Tunnel-ku wuxuu soo sheegaa cinwaan IPv6. Waxba kuma muuqdaan khalad gudaha macmiilka. Natiijada waxaa go'aamiya afar go'aan oo kala duwan: xalliyahayaa jawaabay, VpnService maxuu u caddeeyay Android, qoyska cinwaan ee browser-ku diyaar u ahaa inuu tijaabiyo, iyo in xirmo ay samayn karto safarka tag iyo ku soo noqo. Ka shaqee sidan habaysan halkii aad ku dari lahayd waddo caadi ah oo aad rajayn lahayd in calaamaddu dhaqaaqdo.

Tallaabo 1: caddee xalliyahayaa ka jawaabay su'aasha AAAA

Android ma laha hal waddo DNS. VPN waxa uu ku riixi karaa server DNS shabakaddiisa, nidaamku waxa uu isticmaali karaa Private DNS magacyada martigeliyaha uu u arko kuwo u qalma, Chrome-na waxa uu ordi karaa xalliyahiisa sirta ah isagoo ka socda chrome://settings/security. Taleefan uu tunnel-ku ku riixayo 10.61.0.1 laakiin Private DNS uu tilmaamayo bixiye dadweyne, magaca ku jira aaggaaga gaarka ah ma xalliyo mashiinka leh aagga. Browser-ku wuxuu jawaab ka helaa xalliye aan awood u lahayn magacaas wuxuuna u arkaa mid maqan, qoraalka khaladkuna waligiis ma xuso DNS.

Weydii xalliyaha tunnel-ka si toos ah ka hor inta aadan wax kale beddelin. Labada amarrood ee ugu horreeya waxay muujinayaan server-rada DNS ee Android ku xidhay shabakadda firfircoon iyo in Private DNS uu ku jiro hab toos ah ama adag; tan saddexaad waxay ka socotaa macmiil kasta oo ku jira tunnel-ka, ma aha taleefanka.

adb shell dumpsys connectivity | grep -A3 "DnsAddresses"
adb shell settings get global private_dns_mode
nslookup -type=AAAA nas.lan 10.61.0.1

Tallaabo 2: akhri waxa VpnService run ahaantii caddeeyay

Dhinaca Android waa mid cad, ma aha mid la soo saaray. VpnService.Builder wuxuu ku darayaa cinwaanno addAddress, waddooyin addRoute, server-ro DNS addDnsServer, wuxuuna ku xaddidi karaa tunnel-ka oo dhan hal qoys cinwaan allowFamily. Dhisaha u yeedhay allowFamily(AF_INET) kadibna ku daray waddo IPv6 wuxuu nidaamka u sheegay laba shay oo is khilaafsan, nidaamkuna wuxuu hayaa xaddidaadda qoyska. Waddo daboolaysa fd00:61::/64 oo lala midoobay cinwaan isdhexgal oo ku jira prefix kale waxay ku guuldarraysataa sabab la mid ah: cinwaanku wuu jiraa, laakiin on-link kama aha waddadaas.

Akhri caddaynta halkii aad ka aamini lahayd badhanka ku jira app-ka. dumpsys netd wuxuu daabacaa cinwaannada iyo waddooyinka ku xiran isdhexgalka tun, LinkProperties-na shabakad kasta gudaheed dumpsys connectivity wuxuu muujinayaa liiska DNS dhinaca qoysaska uu shabakadku sheeganayo.

adb shell ip -6 addr show tun0
adb shell ip -6 route show table all | grep tun0
adb shell dumpsys connectivity | grep -E "LinkAddresses|Routes"

Haddii isdhexgalka tun uu leeyahay cinwaan IPv6 laakiin aanay jirin waddo la socota prefix-ka adeegga, keenista IPv6 horey ayay u burbursan tahay ka hor inta uusan browser soo gelin. Tani waa bug ka duwan browser diida inuu tijaabiyo, waxayna u baahan tahay hagaajin kale.

Tallaabo 3: browser-ku wuxuu go'aansadaa inuu IPv6 tijaabiyo iyo in kale

Chromium ma isticmaalo dhammaan diiwaannada AAAA ee uu helo. Xalliyaha martigeliyaha waxa uu qaadaa hubinno gaaritaan IPv6 iyo shaandhayn musharrax oo ku tuuri kara ama hoos u dhigi kara mudnaanta IPv6 marka shabakadda loo arko mid aan awood u lahayn inay qaaddo, il xalliyaha-na wuxuu muujinayaa baaritaankaas iyo shuruudaha ku hareeraysan. Mantiqtu waxay ku xiran tahay nooca iyo calaamadaha, sababtaas awgeedna laba taleefan oo isku tunnel ah ayay u kala dhaqmi karaan. Marka musharraxiinnu jiraan, Happy Eyeballs waxa uu qoysaska ku tartamayaa xiriir kasta, sidaas darteed waddo IPv6 oo gaabis ku jawaabta waxay wali ka guuldarraysan kartaa IPv4 si degdeg ah u jawaabta.

Fiiri go'aanka halkii aad ka malayn lahayd. Kulan lagu duubay chrome://net-export oo lagu dib u celiyay bandhiga netlog wuxuu muujinayaa xal kasta iyo qoyska la doortay; chrome://net-internals/#dns wuxuu muujinayaa natiijooyinka keydka. Xal magac leh AAAA xalliyaagaaga uun u soo celiya diiwaannada A wuxuu si toos ah u tilmaamayaa marxaladdan.

Tallaabo 4: hubi in xirmo samayn karto safarka tag iyo ku soo noqo

Doorashada cinwaanku ma aha keenis. Android waxa uu hayaa shaxda waddooyinka iyo xeerarka siyaasadda shabakad kasta oo shaxda ku doorta fwmark, sidaas darteed waddo ka muuqata shaxda ugu weyn ma aha si toos ah tan uu isticmaalo socket. Akhriska xeerarka iyo weydiinta kernel-ka inuu xalliyo meel loo socdo cinwaan laga soo jeedo ayaa kala saara labadaas.

adb shell ip -6 rule show
adb shell ip -6 route get fd00:61::20 from fd00:61::10

Waxaa su'aasha ka jawaabaya soosaarka route get. Haddii uu sheegto tun0 oo xirmooyinku wali dhintaan, u gudub MTU tunnel-ka iyo gudbinta IPv6 ee iridda halkii aad ku noqon lahayd taleefanka.

Sababta ku darista ::/0 inta badan uga sii dartaa

Ku darista ::/0 waxay beddelaysaa sheegashada tunnel-ka min hal prefix oo u gudubta meel kasta oo IPv6 ah. Taleefanka waxay buuxin kartaa baaritaan gaaritaan, maxaa yeelay cinwaan tijaabo oo ka baxsan prefix-kaaga hadda wuxuu u muuqdaa mid la mari karo. Laakiin ma abuurto awood IPv6 kor u socota iridda, irido badan oo guri-na ma laha xiriir kor u socda oo IPv6 ah oo shaqeeya. Natiijadu waa god madow oo IPv6 dadweyne ah: magacyadii hore ugu dhici jiray IPv4 hadda way laalaadaan, bogga gaarkana wuu u muuqan karaa mid ka wanaagsan sababta oo ah baaritaanku wax kale ayuu cabbiraa.

Kharash siyaasadeed ayaa sidoo kale jira. Marka ::/0 uu ku jiro tunnel-ka, dhammaan taraafikada IPv6 waxay ka baxdaa VPN-ka, oo ay ku jirto taraafikada milkiilaha shabakaddu waligiis ogolaan inuu qaado. U qaado tan go'aan daabacaad oo leh milkiile magac leh, ma aha tallaabo sixid oo aad qaadanayso 1 saac habeenkii.

Habka shaqada ee tan soo afjaraya

Xaqiiji in jawaabta AAAA ay ka timaaddo xalliyaha hayaa aagga, akhri xaaladda VpnService iyo netd ee isdhexgalka tun, qaado raad net-export si aad u aragto haddii Chromium tuuray musharraxii, kadib tijaabi safarka tag iyo ku soo noqo ip -6 route get. Hagaaji lakabka run ahaantii guuldarraysaday oo ka tag siyaasadda kala qaybinta. Haddii magacyada gaarku u baahan yihiin jawaabo ka duwan kuwa dadweynaha, split tunneling ayaa taas loogu talagalay.

Qor build-ka taleefanka, nooca browser-ka iyo xalliyaha aad weydiisay. Saddexda xaqiiqo waxay "IPv6 is broken" u beddelaan wax qofka xiga uu soo saari karo.